We Don't Track You

✓ The Short Version

• ✓ Tests run in your browser. By default the results never leave it.
• ✓ We store a result only if you tick the share box after a test. It is unchecked every time.
• ✓ Your IP address is never written to our database - not even when you do share.
• ✓ No analytics platforms, no advertising cookies, no tracking pixels.
• ✓ No accounts, no registration, no email address required for anything.
• ✓ We do not sell data. Shared results are published only as aggregates.

How Our Tests Work

All VPN tests run in your browser using JavaScript. Your browser makes direct requests to third-party public APIs, and the results are displayed on the page and held only in the page’s memory. Closing the tab discards them.

Third-party endpoints your browser contacts during tests, each subject to its own privacy policy:

• · ipapi.co - IP geolocation and ASN lookup
• · api64.ipify.org - IPv6 detection
• · speed.cloudflare.com - speed test endpoints
• · stun.l.google.com - WebRTC STUN server for leak detection
• · check.torproject.org - Tor exit node lookup, on the proxy detection page only

Server-Side IP Lookup

Two features need our server to see your IP address: the “What Is My IP” display, and identifying which network a shared test result came from. In both cases our server sends your IP to ip-api.com to look up the country and network operator, then uses the answer and discards the address.

The lookup result is cached for 30 minutes to avoid repeating the request. That cache holds only the derived values - country, city, network operator - and never the address itself. The cache entry is filed under a keyed hash of your IP whose secret is regenerated every day, so it cannot be worked backwards into an address and cannot be matched against the previous day’s entries.

Your IP is transmitted to ip-api.com as part of this lookup. If you would rather that did not happen, do not use the What Is My IP page and do not share test results.

Shared Test Results (Opt-In)

After a test you may tick a box to contribute the result to our public VPN database. This is the only circumstance in which we store anything about a test. The box is unchecked on every run, its state is never remembered, and if you ignore it nothing is transmitted.

What a shared record contains:

• · The test outcome - for example whether DNS leaked, or the measured speed and latency
• · The VPN provider, either the one you selected or the network operator behind your exit IP
• · The exit country and city of the connection, and the network operator’s name and ASN
• · Your browser family and operating system family - for example “firefox” and “windows”
• · A country code derived from your browser’s language setting
• · A random token generated for the browser tab, used to pair a no-VPN speed measurement with the VPN measurement that follows it
• · A keyed hash of your IP address, used to rate-limit abuse

What it never contains:

• · Your IP address, in any form that can be read back
• · Any name, email address, account or persistent identifier
• · The websites you visit, your DNS queries, or the contents of your traffic

The hash mentioned above is an HMAC whose secret key is regenerated every day and the previous key discarded. It lets us spot twenty submissions from one source within a day; it cannot be reversed into an address, and two records from the same person on different days cannot be connected.

Shared results are published only in aggregate, and only once a provider has at least 30 of them. Individual submissions are never displayed.

Legal Basis and Your Rights (GDPR)

Where a shared submission constitutes personal data, we process it on the basis of your consent under Article 6(1)(a) - the tick box. You are free not to give it, and every test works identically without it.

We deliberately hold nothing that lets us identify you or single out your submissions. That has a consequence worth stating plainly rather than hiding: we cannot retrieve, correct or delete an individual record on request, because we have no way of telling which one is yours. Under Article 11, a controller who cannot identify a data subject is not required to acquire additional information purely to enable that identification - and we are not willing to start collecting identifiers for that purpose, since doing so would make the situation worse for everyone.

If you withdraw consent, we stop processing going forward; already-submitted anonymous records cannot be singled out for erasure. Please take this into account before ticking the box.

You have the right to lodge a complaint with your national data protection authority.

Cookies and Browser Storage

VPNMeter uses only essential WordPress functional cookies, plus whatever the cookie consent banner records about your choice. We set no advertising or third-party tracking cookies.

The speed test uses your browser’s sessionStorage to hold a random tab token and, if you run one, a no-VPN baseline measurement. Both live only in your own browser, are cleared when you close the tab, and neither is readable by any other site.

Hosting & Server Logs

Separately from anything described above, our web server and its CDN keep standard access logs - IP address, browser user agent, pages requested - as every web server does, for security and uptime. These logs are:

• · Retained for a maximum of 30 days, then deleted
• · Never linked to test results or to shared submissions
• · Not shared with third parties, and not used for advertising or profiling

Affiliate Links and Independence

Some links to VPN providers may earn us a commission. Where that applies it is disclosed on the page itself.

Commission never influences test results, scoring, or the ordering of providers in our results database. Those figures come from measurements, which we neither sell nor accept payment to alter.

Questions

For anything about this policy or our data practices, get in touch:

Contact Us

Changes to This Policy

We may update this policy if our practices change. The date at the top reflects the last update. If we ever change what a shared result contains, this page changes in the same release.